You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@geronimo.apache.org by "Donald Woods (JIRA)" <de...@geronimo.apache.org> on 2005/08/24 22:52:08 UTC
[jira] Created: (GERONIMO-911) Admin Console should require SSL
Admin Console should require SSL
--------------------------------
Key: GERONIMO-911
URL: http://issues.apache.org/jira/browse/GERONIMO-911
Project: Geronimo
Type: Bug
Components: console
Versions: 1.0-M5
Environment: all
Reporter: Donald Woods
Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
Re: [jira] Commented: (GERONIMO-911) Admin Console should require SSL
Posted by Heinz Drews <he...@gmail.com>.
Can the console not use a different port/container from the base
settings? Similar to the approach done in WebSphere.
This would signifcantly reduce the exposure and would not require to
default to HTTPS without proper infrastructure.
Heinz
On 10/19/06, Aaron Mulder (JIRA) <de...@geronimo.apache.org> wrote:
> [ http://issues.apache.org/jira/browse/GERONIMO-911?page=comments#action_12443623 ]
>
> Aaron Mulder commented on GERONIMO-911:
> ---------------------------------------
>
> Not only that, but you get a different warning if the host name of the HTTPS server doesn't match the host name of the certificate. Our only option would be to get a certificate for "localhost" and assume that the user wouldn't put the proper server hostname into the URL (e.g. https://localhost would work but https://my.server.com would not), but I suspect we'd have trouble getting a certificate issued for "localhost" since it would be so subject to abuse.
>
> Bottom line, I don't think we can default to HTTPS. But we can certainly provide a document or wizard to enable HTTPS (where you select a real keystore, enter passwords, etc.) and point you to the HTTPS URL for the console. That would be the better way to go in my opinion.
>
> > Admin Console should require SSL
> > --------------------------------
> >
> > Key: GERONIMO-911
> > URL: http://issues.apache.org/jira/browse/GERONIMO-911
> > Project: Geronimo
> > Issue Type: Improvement
> > Security Level: public(Regular issues)
> > Components: console
> > Affects Versions: 1.0-M5
> > Environment: all
> > Reporter: Donald Woods
> > Assigned To: Donald Woods
> > Priority: Trivial
> > Fix For: 1.x
> >
> > Attachments: Geronimo-911.patch
> >
> >
> > Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> > I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
>
> --
> This message is automatically generated by JIRA.
> -
> If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
> -
> For more information on JIRA, see: http://www.atlassian.com/software/jira
>
>
>
[jira] Updated: (GERONIMO-911) Admin Console should require SSL
Posted by "Aaron Mulder (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=all ]
Aaron Mulder updated GERONIMO-911:
----------------------------------
Fix Version: Wish List
The only problem I have with this is that our SSL cert is self-signed, so that would mean everyone who visits the console (at least for the first time) gets an error about an untrusted certificate. That doesn't seem like a good first impression. I don't think we should require SSL unless we have a default certificate that IE, Firefix, Safari, and Opera consider valid.
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Type: Bug
> Components: console
> Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Fix For: Wish List
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Commented: (GERONIMO-911) Admin Console should require SSL
Posted by "Guillaume Nodet (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=comments#action_12443604 ]
Guillaume Nodet commented on GERONIMO-911:
------------------------------------------
I would be happy to check this patch in (at least an updated one).
Any objections ?
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Components: console
> Affects Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assigned To: Donald Woods
> Priority: Trivial
> Fix For: 1.x
>
> Attachments: Geronimo-911.patch
>
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Assigned: (GERONIMO-911) Admin Console should require SSL
Posted by "Donald Woods (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=all ]
Donald Woods reassigned GERONIMO-911:
-------------------------------------
Assign To: Donald Woods
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Type: Bug
> Components: console
> Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assignee: Donald Woods
> Fix For: Wish List
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Commented: (GERONIMO-911) Admin Console should require SSL
Posted by "Aaron Mulder (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=comments#action_12443623 ]
Aaron Mulder commented on GERONIMO-911:
---------------------------------------
Not only that, but you get a different warning if the host name of the HTTPS server doesn't match the host name of the certificate. Our only option would be to get a certificate for "localhost" and assume that the user wouldn't put the proper server hostname into the URL (e.g. https://localhost would work but https://my.server.com would not), but I suspect we'd have trouble getting a certificate issued for "localhost" since it would be so subject to abuse.
Bottom line, I don't think we can default to HTTPS. But we can certainly provide a document or wizard to enable HTTPS (where you select a real keystore, enter passwords, etc.) and point you to the HTTPS URL for the console. That would be the better way to go in my opinion.
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Components: console
> Affects Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assigned To: Donald Woods
> Priority: Trivial
> Fix For: 1.x
>
> Attachments: Geronimo-911.patch
>
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (GERONIMO-911) Admin Console should require SSL
Posted by "Donald Woods (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=all ]
Donald Woods updated GERONIMO-911:
----------------------------------
Attachment: Geronimo-911.patch
Patch to be applied before Geronimo-973 to secure all access to the Admin Console over SSL.
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Type: Improvement
> Components: console
> Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assignee: Donald Woods
> Priority: Trivial
> Fix For: 1.x
> Attachments: Geronimo-911.patch
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Commented: (GERONIMO-911) Admin Console should require SSL
Posted by "Guillaume Nodet (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=comments#action_12443607 ]
Guillaume Nodet commented on GERONIMO-911:
------------------------------------------
I missed Aaron comment :(
and I agree it would not be very user friendly...
Is there any way to have certificate for IE, Firefix, Safari, and Opera ?
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Components: console
> Affects Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assigned To: Donald Woods
> Priority: Trivial
> Fix For: 1.x
>
> Attachments: Geronimo-911.patch
>
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (GERONIMO-911) Admin Console should require SSL
Posted by "Donald Woods (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=all ]
Donald Woods updated GERONIMO-911:
----------------------------------
Geronimo Info: [Patch Available]
type: Improvement (was: Bug)
Fix Version: 1.x
(was: Wish List)
Priority: Trivial (was: Major)
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Type: Improvement
> Components: console
> Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assignee: Donald Woods
> Priority: Trivial
> Fix For: 1.x
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Commented: (GERONIMO-911) Admin Console should require SSL
Posted by "Paul McMahan (JIRA)" <de...@geronimo.apache.org>.
[ http://issues.apache.org/jira/browse/GERONIMO-911?page=comments#action_12443609 ]
Paul McMahan commented on GERONIMO-911:
---------------------------------------
IANASE. But I agree with Aaron's comment that the warning message about self-signed cert would not make a good first impression. The only way that I know of to avoid the message would be for Geronimo to use a certificate that has been signed by a trusted root ca like verisign or thawte. I notice that https://svn.apache.org uses a cert signed by Starfield and that one does not produce a browser warning. I wonder if ASF might be able to provide its projects with certificates signed by a trusted CA? Even if so I am doubtful it would be appropriate to redistribute that cert in a server assembly.
> Admin Console should require SSL
> --------------------------------
>
> Key: GERONIMO-911
> URL: http://issues.apache.org/jira/browse/GERONIMO-911
> Project: Geronimo
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Components: console
> Affects Versions: 1.0-M5
> Environment: all
> Reporter: Donald Woods
> Assigned To: Donald Woods
> Priority: Trivial
> Fix For: 1.x
>
> Attachments: Geronimo-911.patch
>
>
> Admin Console login and Portlet access should require SSL to protect the system password and any connector/DB/LDAP configured passwords in the Portlets.
> I'm willing to create and post a patch for this, once I get a couple other items off my plate... -Donald
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira